The OP could mean that the security-related tasks added zero benefit because they were unnecessary tasks that didn't result in increased security.

There are plenty of security-related tasks that have zero, or even negative, benefit.

- Obtaining EV certificates for your websites.

- Enforcing password rotation every 90 days.

- Adding a webapp firewall in front of your static file hosting (e.g. S3).